Google’s stock tanked this week after the accidental early release of their 3Q 2012 earnings. It wasn’t the fault of the preliminary release (though that certainly didn’t help things), but rather the disappointing earnings. Earnings per share were $9.03, way off the $10.65 that analysts expected. (See all Google filings for the period.)

Part of the problem for the company were Motorola’s losses, which were $527 million for the quarter. It’s clear that advertising continues to be their cash cow, accounting for 77% of Google’s revenues. Their AdWords program alone brings in more than $100 million per day.

But therein lies the bigger problem for Google. Although their advertising revenues were up, both aggregate paid clicks and price-per-click are declining. Cost-per-click declined 15% over the same period last year:

As Business Insider notes, mobile devices have added a huge supply of cheap inventory, and prices fall when supply outstrips demand.

During the October 18 earnings call (video, transcript) Team Google devoted a great deal of time to discussing the trends that would overcome these obstacles and drive their business growth in the future. Their ability to monetize these trends, however, depends on combining user data gathered across their various platforms in order to target consumers more specifically. And the EU data protection authorities just told them that the way they’re doing that is illegal.

Fore example, here is Nikesh Arora, Senior Vice President and Chief Business Officer for Google, who explained how Google hopes to increase advertising value for clients like T-Mobile does by targeting users when they are close to a T-Mobile store:

Take T-Mobile, who use location based mobile ads to drive people nearby into their stores, and in their words, win the last 10 feet. They achieved a click-through rate of about 13%, in what is a very successful strategy. These rates are 3 to 4 times of what you would see without using some of these context.

I’m frankly surprised that none of the analysts asked about the part of the letter from the EU Data Protection authorities which comes right out and states that Google does not have a legal basis for combining data in this way:

European Data Protection legislation provides a precise framework for personal data processing operations. Google must have a legal basis to perform the combination of data of each of these purposes and data collection must also remain proportionate to the purposes pursued. However, for some of these purposes including advertising, the processing does not rely on consent, on Google’s legitimate interests, nor on the performance of a contract.

In fact, in the Annex: G29′s Recommendations for Google (PDF), the authorities specifically say that Google should “collect explicit consent for the combination of data for the purposes of service improvements without the user’s direct knowledge, product development and marketing innovation, advertising and analytics” (their emphasis).

Which means that Google’s ability to do what it does in the T-Mobile example — target an ad at someone’s mobile device based on knowledge of their physically proximity to an advertiser’s store — will require a specific opt-in. Which Google most certainly does not require at the moment. In fact, as the letter notes, it requires navigating 6 screens to even opt-out.

Simon Davies is one of the rare voices to go on record saying that Google’s entire business model is thus threatened:

Here the regulators are not simply requiring a change to the privacy policy, but a change to the Google business model. This will be the finding that the company has feared most of all, because it blatantly asserts that its’ business practices are in conflict with EU law.

Google dismissed the letter saying it was not as harsh as they expected. But as Davies notes, “the reality is that the letter is an iron fist in a velvet glove. Although camouflaged with words such as ‘challenge’ and ‘request’ the letter clearly opens the litigation terrain to national regulators who will be doing more than ‘requesting.’ Article 29 has created an evidence-based foundation for all regulators to commence legal proceedings.”

Google revenues from outside of the United States totaled $6.11 billion for the third quarter, or 53% of their total revenues. It’s difficult to see how the EU challenging the legality of their practices is not a threat to both Google’s business plan as well as their bottom line.